{"id":"CVE-2020-12137","aliases":["DEBIAN-CVE-2020-12137","DLA-2200-1","DSA-4664-1","EUVD-2020-4452","GHSA-7mvx-jp9h-p8gh","MGASA-2020-0276","OESA-2021-1405","RHSA-2020:4667","SUSE-SU-2020:1301-1","SUSE-SU-2020:14356-1","UBUNTU-CVE-2020-12137","USN-4348-1","USN-5121-2","openSUSE-SU-2020:1707-1","openSUSE-SU-2020:1752-1"],"status":"published","title":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME...","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02288,"percentile":0.83338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-04-24T12:37:58Z","modified":"2026-08-18T01:16:06Z","fixes":[{"ecosystem":"Debian:8","package":"mailman","fixed_in":["1:2.1.18-2+deb8u5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"mailman","fixed_in":["1:2.1.23-1+deb9u5"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"mailman","fixed_in":["1:2.1.29-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman","fixed_in":["3:2.1.29-10.module+el8.3.0+6860+8e47d84b"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman-debuginfo","fixed_in":["3:2.1.29-10.module+el8.3.0+6860+8e47d84b"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman-debugsource","fixed_in":["3:2.1.29-10.module+el8.3.0+6860+8e47d84b"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mailman","fixed_in":["2.1.15-9.6.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mailman","fixed_in":["2.1.15-9.6.20.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mailman","fixed_in":["1:2.1.20-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mailman","fixed_in":["1:2.1.26-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mailman","fixed_in":["1:2.1.29-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.18-2+deb8u5"}]}],"versions":["1:2.1.18-2","1:2.1.18-2+deb8u1","1:2.1.18-2+deb8u2","1:2.1.18-2+deb8u3","1:2.1.18-2+deb8u4"]},{"source":"osv","ecosystem":"Debian:9","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.23-1+deb9u5"}]}],"versions":["1:2.1.23-1","1:2.1.23-1+deb9u1","1:2.1.23-1+deb9u2","1:2.1.23-1+deb9u3","1:2.1.23-1+deb9u4"]},{"source":"osv","ecosystem":"Debian:10","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.29-1+deb10u1"}]}],"versions":["1:2.1.29-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.33-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.29-8.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.29-8.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.29-10.module+el8.3.0+6860+8e47d84b"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.29-10.module+el8.3.0+6860+8e47d84b"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mailman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.29-10.module+el8.3.0+6860+8e47d84b"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.17-3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.15-9.6.20.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.20-1ubuntu0.4"}]}],"versions":["1:2.1.20-1","1:2.1.20-1ubuntu0.1","1:2.1.20-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.26-1ubuntu0.1"}]}],"versions":["1:2.1.23-1","1:2.1.24-1","1:2.1.25-1","1:2.1.26-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.29-1ubuntu3.1"}]}],"versions":["1:2.1.29-1","1:2.1.29-1build1","1:2.1.29-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.20-1ubuntu0.4"}]}],"versions":["1:2.1.20-1","1:2.1.20-1ubuntu0.1","1:2.1.20-1ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.26-1ubuntu0.1"}]}],"versions":["1:2.1.23-1","1:2.1.24-1","1:2.1.25-1","1:2.1.26-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1.29-1ubuntu3.1"}]}],"versions":["1:2.1.29-1","1:2.1.29-1build1","1:2.1.29-1ubuntu3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.34-lp152.7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"mailman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.34-bp152.7.3.1"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"mailman"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2020/02/24/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/02/24/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","report"]},{"url":"http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/24/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4664","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4348-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4COSBBEMJYLV7WSW5QTUJUOFJFK47KK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12137","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4COSBBEMJYLV7WSW5QTUJUOFJFK47KK/"},{"url":"https://github.com/advisories/GHSA-7mvx-jp9h-p8gh"},{"url":"https://advisories.mageia.org/MGASA-2020-0276.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26253","tags":["report"]},{"url":"https://mail.python.org/pipermail/mailman-announce/2020-April/000250.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42097","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4667","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1837218","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4667.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12137","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201301-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1167068","tags":["report"]},{"url":"https://bugzilla.suse.com/1170558","tags":["report"]},{"url":"https://bugzilla.suse.com/1171363","tags":["report"]},{"url":"https://bugzilla.suse.com/682920","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014356-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-12137","tags":["report"]},{"url":"http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1801","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4348-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5121-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-0618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42097","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6LXSIVYX5GOPLZQNIV3JT72GQ7L536DK/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173369","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15011","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z4ZASCRNOELSGFUS6XMOBBM2KR7G3COA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-12137","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","status":"published","published":"2020-04-24T12:37:58Z","modified":"2024-08-04T11:48:58.357Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2020-4452","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","status":"published","published":"2020-04-24T12:37:58Z","modified":"2024-08-04T11:48:58Z","updated_at":"2026-11-03T03:07:40.81889Z"}],"ghsa":[{"id":"GHSA-7mvx-jp9h-p8gh","title":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME...","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","status":"published","published":"2022-05-24T17:16:25Z","modified":"2023-01-28T05:02:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:48.829893Z"}],"nvd":[{"id":"CVE-2020-12137","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","status":"published","published":"2020-04-24T13:15:11.78Z","modified":"2026-06-17T02:51:28.203Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:59.718774Z"}],"osv":[{"id":"OESA-2021-1405","title":"mailman security update","description":"Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more.\r\n\r\nSecurity Fix(es):\r\n\r\n/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.(CVE-2020-12108)\r\n\r\nGNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.(CVE-2020-12137)\r\n\r\nGNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.(CVE-2020-15011)\n\nGNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.(CVE-2021-42096)\n\nGNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).(CVE-2021-42097)","status":"published","published":"2021-10-30T11:04:40Z","modified":"2026-08-18T01:16:06.485064176Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2020:4667","title":"Red Hat Security Advisory: mailman:2.1 security and bug fix update","status":"published","published":"2024-09-16T04:07:55Z","modified":"2026-01-14T11:04:26.921752Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-12137","description":"GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.","status":"published","published":"2020-04-24T13:15:00Z","modified":"2026-02-04T02:23:07.421935Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-2200-1","title":"mailman - security update","status":"published","published":"2020-05-03T00:00:00Z","modified":"2026-03-09T01:23:27.163547Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4664-1","title":"mailman - security update","status":"published","published":"2020-04-26T00:00:00Z","modified":"2026-03-09T02:09:11.368307Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0276","title":"Updated mailman packages fix security vulnerability","description":"Updated mailman package fixes security vulnerability:\n\nUp to mailman 2.1.29 when sending a file without a file extension (or an\nunknown file extension) then the file is stored in the list archive with\nthe file extension .obj. Most web servers will try to assign a mime type\nbased on the file extension and entries in /etc/mime.types, where .obj is\nusually not specified. This means the web server will send it out without\na mime type. \nThe browser will then try to guess the MIME type based on the file's\ncontent (MIME-sniffing). If the content is HTML then it will execute any\njavascript contained, leading to a potential cross-site scripting\nvulnerability.\n\nThe mailman package has been updated to version 2.1.30, fixing this bug\nand other issues.  See the release announcement for details.\n","status":"published","published":"2020-07-05T08:46:44Z","modified":"2026-04-16T04:43:00.081620322Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1707-1","title":"Recommended update for mailman","description":"\nThis update for mailman to version 2.1.34 fixes the following issues:\n\n - The fix for lp#1859104 can result in ValueError being thrown\n   on attempts to subscribe to a list. This is fixed and\n   extended to apply REFUSE_SECOND_PENDING to unsubscription as\n   well. (lp#1878458)\n - DMARC mitigation no longer misses if the domain name returned\n   by DNS contains upper case. (lp#1881035)\n - A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to\n   prevent mailbombing of a member of a list with private\n   rosters by repeated subscribe attempts. (lp#1883017)\n - Very long filenames for scrubbed attachments are now\n   truncated. (lp#1884456)\n - A content injection vulnerability via the private login page\n   has been fixed. CVE-2020-15011  (lp#1877379, bsc#1173369)\n - A content injection vulnerability via the options login page\n   has been discovered and reported by Vishal Singh.\n   CVE-2020-12108 (lp#1873722, bsc#1171363)\n - Bounce recognition for a non-compliant Yahoo format is added.\n - Archiving workaround for non-ascii in string.lowercase in\n   some Python packages is added.\n - Thanks to Jim Popovitch, there is now\n   a dmarc_moderation_addresses list setting that can be used to\n   apply dmarc_moderation_action to mail From: addresses listed\n   or matching listed regexps. This can be used to modify mail\n   to addresses that don't accept external mail From:\n   themselves.\n - There is a new MAX_LISTNAME_LENGTH setting. The fix for\n   lp#1780874 obtains a list of the names of all the all the\n   lists in the installation in order to determine the maximum\n   length of a legitimate list name. It does this on every web\n   access and on sites with a very large number of lists, this\n   can have performance implications. See the description in\n   Defaults.py for more information.\n - Thanks to Ralf Jung there is now the ability to add text\n   based captchas (aka textchas) to the listinfo subscribe form.\n   See the documentation for the new CAPTCHA setting in\n   Defaults.py for how to enable this. Also note that if you\n   have custom listinfo.html templates, you will have to add\n   a \u003cmm-captcha-ui\u003e tag to those templates to make this work.\n   This feature can be used in combination with or instead of\n   the Google reCAPTCHA feature added in 2.1.26.\n - Thanks to Ralf Hildebrandt the web admin Membership\n   Management section now has a feature to sync the list's\n   membership with a list of email addresses as with the\n   bin/sync_members command.\n - There is a new drop_cc list attribute set from\n   DEFAULT_DROP_CC. This controls the dropping of addresses from\n   the Cc: header in delivered messages by the duplicate\n   avoidance process. (lp#1845751)\n - There is a new REFUSE_SECOND_PENDING mm_cfg.py setting that\n   will cause a second request to subscribe to a list when there\n   is already a pending confirmation for that user. This can be\n   set to Yes to prevent mailbombing of a third party by\n   repeatedly posting the subscribe form. (lp#1859104)\n - Fixed the confirm CGI to catch a rare TypeError on\n   simultaneous confirmations of the same token. (lp#1785854)\n - Scrubbed application/octet-stream MIME parts will now be\n   given a .bin extension instead of .obj. CVE-2020-12137\n   (lp#1886117)\n - Added bounce recognition for a non-compliant opensmtpd DSN\n   with Action: error. (lp#1805137)\n - Corrected and augmented some security log messages.\n   (lp#1810098)\n - Implemented use of QRUNNER_SLEEP_TIME for bin/qrunner\n   --runner=All. (lp#1818205)\n - Leading/trailing spaces in provided email addresses for login\n   to private archives and the user options page are now\n   ignored. (lp#1818872)\n - Fixed the spelling of the --no-restart option for mailmanctl.\n - Fixed an issue where certain combinations of charset and\n   invalid characters in a list's description could produce\n   a List-ID header without angle brackets. (lp#1831321)\n - With the Postfix MTA and virtual domains, mappings for the\n   site list -bounces and -request addresses in each virtual\n   domain are now added to data/virtual-mailman (-owner was done\n   in 2.1.24). (lp#1831777)\n - The paths.py module now extends sys.path with the result of\n   site.getsitepackages() if available. (lp#1838866)\n - A bug causing a UnicodeDecodeError in preparing to send the\n   confirmation request message to a new subscriber has been\n   fixed. (lp#1851442)\n - The SimpleMatch heuristic bounce recognizer has been improved\n   to not return most invalid email addresses. (lp#1859011)\n    ","status":"published","published":"2020-10-22T12:27:35Z","modified":"2026-02-04T02:59:26.065522Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1752-1","title":"Recommended update for mailman","description":"\nThis update for mailman to version 2.1.34 fixes the following issues:\n\n - The fix for lp#1859104 can result in ValueError being thrown\n   on attempts to subscribe to a list. This is fixed and\n   extended to apply REFUSE_SECOND_PENDING to unsubscription as\n   well. (lp#1878458)\n - DMARC mitigation no longer misses if the domain name returned\n   by DNS contains upper case. (lp#1881035)\n - A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to\n   prevent mailbombing of a member of a list with private\n   rosters by repeated subscribe attempts. (lp#1883017)\n - Very long filenames for scrubbed attachments are now\n   truncated. (lp#1884456)\n - A content injection vulnerability via the private login page\n   has been fixed. CVE-2020-15011  (lp#1877379, bsc#1173369)\n - A content injection vulnerability via the options login page\n   has been discovered and reported by Vishal Singh.\n   CVE-2020-12108 (lp#1873722, bsc#1171363)\n - Bounce recognition for a non-compliant Yahoo format is added.\n - Archiving workaround for non-ascii in string.lowercase in\n   some Python packages is added.\n - Thanks to Jim Popovitch, there is now\n   a dmarc_moderation_addresses list setting that can be used to\n   apply dmarc_moderation_action to mail From: addresses listed\n   or matching listed regexps. This can be used to modify mail\n   to addresses that don't accept external mail From:\n   themselves.\n - There is a new MAX_LISTNAME_LENGTH setting. The fix for\n   lp#1780874 obtains a list of the names of all the all the\n   lists in the installation in order to determine the maximum\n   length of a legitimate list name. It does this on every web\n   access and on sites with a very large number of lists, this\n   can have performance implications. See the description in\n   Defaults.py for more information.\n - Thanks to Ralf Jung there is now the ability to add text\n   based captchas (aka textchas) to the listinfo subscribe form.\n   See the documentation for the new CAPTCHA setting in\n   Defaults.py for how to enable this. Also note that if you\n   have custom listinfo.html templates, you will have to add\n   a \u003cmm-captcha-ui\u003e tag to those templates to make this work.\n   This feature can be used in combination with or instead of\n   the Google reCAPTCHA feature added in 2.1.26.\n - Thanks to Ralf Hildebrandt the web admin Membership\n   Management section now has a feature to sync the list's\n   membership with a list of email addresses as with the\n   bin/sync_members command.\n - There is a new drop_cc list attribute set from\n   DEFAULT_DROP_CC. This controls the dropping of addresses from\n   the Cc: header in delivered messages by the duplicate\n   avoidance process. (lp#1845751)\n - There is a new REFUSE_SECOND_PENDING mm_cfg.py setting that\n   will cause a second request to subscribe to a list when there\n   is already a pending confirmation for that user. This can be\n   set to Yes to prevent mailbombing of a third party by\n   repeatedly posting the subscribe form. (lp#1859104)\n - Fixed the confirm CGI to catch a rare TypeError on\n   simultaneous confirmations of the same token. (lp#1785854)\n - Scrubbed application/octet-stream MIME parts will now be\n   given a .bin extension instead of .obj. CVE-2020-12137\n   (lp#1886117)\n - Added bounce recognition for a non-compliant opensmtpd DSN\n   with Action: error. (lp#1805137)\n - Corrected and augmented some security log messages.\n   (lp#1810098)\n - Implemented use of QRUNNER_SLEEP_TIME for bin/qrunner\n   --runner=All. (lp#1818205)\n - Leading/trailing spaces in provided email addresses for login\n   to private archives and the user options page are now\n   ignored. (lp#1818872)\n - Fixed the spelling of the --no-restart option for mailmanctl.\n - Fixed an issue where certain combinations of charset and\n   invalid characters in a list's description could produce\n   a List-ID header without angle brackets. (lp#1831321)\n - With the Postfix MTA and virtual domains, mappings for the\n   site list -bounces and -request addresses in each virtual\n   domain are now added to data/virtual-mailman (-owner was done\n   in 2.1.24). (lp#1831777)\n - The paths.py module now extends sys.path with the result of\n   site.getsitepackages() if available. (lp#1838866)\n - A bug causing a UnicodeDecodeError in preparing to send the\n   confirmation request message to a new subscriber has been\n   fixed. (lp#1851442)\n - The SimpleMatch heuristic bounce recognizer has been improved\n   to not return most invalid email addresses. (lp#1859011)\n    \nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-10-27T09:21:55Z","modified":"2025-05-07T18:11:21.409006Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:1301-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2020-12108: Fixed a content injection bug (bsc#1171363).\n- CVE-2020-12137: Fixed a XSS vulnerability caused by MIME type confusion (bsc#1170558).\n\nNon-security issue fixed:\n\n- Fixed rights and ownership on /var/lib/mailman/archives (bsc#1167068).\n- Don't default to invalid hosts for DEFAULT_EMAIL_HOST (bsc#682920).\n","status":"published","published":"2020-05-18T05:47:04Z","modified":"2026-02-04T03:11:21.448959Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14356-1","title":"Security update for mailman","description":"This update for mailman fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2020-12137: Fixed a XSS vulnerability caused by MIME type confusion (bsc#1170558).\n\nNon-security issue fixed:\n\n- Fixed rights and ownership on /var/lib/mailman/archives (bsc#1167068).\n","status":"published","published":"2020-05-05T07:49:37Z","modified":"2026-02-04T03:30:17.598986Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4348-1","title":"mailman vulnerabilities","description":"It was discovered that Mailman incorrectly handled certain inputs.\nAn attacker could possibly use this to issue execute arbitrary scripts\nor HTML. (CVE-2018-0618)\n\nIt was discovered that Mailman incorrectly handled certain inputs.\nAn attacker could possibly use this issue to display arbitrary text\non a web page. (CVE-2018-13796)\n\nIt was discovered that Mailman incorrectly handled certain files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-12137)\n","status":"published","published":"2020-04-29T14:40:50Z","modified":"2026-02-10T04:41:49Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-5121-2","title":"mailman vulnerabilities","description":"USN-5009-1 fixed vulnerabilities in Mailman. This update provides the\ncorresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs\nwere fixed:\n\nIt was discovered that Mailman allows arbitrary content injection. An attacker\ncould use this to inject malicious content. (CVE-2020-12108, CVE-2020-15011)\n\nIt was discovered that Mailman improperly sanitize the MIME content. An\nattacker could obtain sensitive information by sending a special type of\nattachment. (CVE-2020-12137)\n\nOriginal advisory details:\n\nAndre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman\ndid not properly associate cross-site request forgery (CSRF) tokens\nto specific accounts. A remote attacker could use this to perform a\nCSRF attack to gain access to another account. (CVE-2021-42097)\n\nAndre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman’s\ncross-site request forgery (CSRF) tokens for the options page are\nderived from the admin password. A remote attacker could possibly use\nthis to assist in performing a brute force attack against the admin\npassword. (CVE-2021-42096)\n","status":"published","published":"2021-11-01T11:49:48Z","modified":"2026-02-10T04:42:21Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}